1

Report

Best practice for isolation when

working on hydrocarbon equipment:

planning, isolation and reinstatement

21 June 2013

Approved by Norwegian Oil and Gas

- HSE Managers Forum 23 May 2013

- Operations Committee 20 June 2013

This report is written in Norwegian and translated into

English. The Norwegian version is the official one.

2

Foreword

This report provides recommendations on best practice for preparation, execution and

reinstatement when working on hydrocarbon equipment. It has been compiled as part of the

hydrocarbon leak reduction project. The background is a cause analysis which shows that a

substantial proportion of the hydrocarbon leaks on the Norwegian continental shelf (NCS)

relate to the above-mentioned operations.

The document has been created by a work group comprising representatives from a number of

the operator companies on the NCS. Eleven all-day and two half-day meetings have been held

from the autumn of 2011 to the spring of 2013. A total of 42 different people have attended

these meetings.

Participants in the work group have been:1

Vidar Bringsli, ExxonMobil

Sveinung Enggrav, ConocoPhillips

Jens Petter Gjærum, GdF Suez

Tor Arne Grimsrud, Shell

Anne Hilde Halleraker, ConocoPhillips

Henrik Madsen, Marathon Oil

Einar Møvik, Statoil

John Olsen, BP

Jan Petter Pettersen, Talisman

Willy Røed, Norwegian Oil and Gas

Bjarte Skulstad, BP

Arne Tøkje, Talisman

Jan Erik Vinnem, Norwegian Oil and Gas

John Waage, BP

The report has been circulated for comment in the hydrocarbon leak reduction network, which

involves Norwegian Oil and Gas, the Petroleum Safety Authority Norway (PSA), the

Norwegian Union of Energy Workers (Safe) and the IndustriEnergi union.

Approval of the content has been given by the members of Norwegian Oil and Gas.2 It is

up to each company on the NCS to check that its own management system accords with

these recommendations. The content of the report only becomes “requirements” when it has been incorporated in the

company’s own management system.

1 Participants have been listed in alphabetical order. People who have only taken part in one or two meetings are

not included. 2 The report was approved by the HSE Managers Forum on 23 May 2013 and the Operations Committee on 20

June 2013.

The report is in two parts

Part 1 comprises the main section, which presents the recommendations of the work group.

Part 2 contains information on the background for the recommendations.

3

PART 1: Recommendations on best practice for preparation, execution and

reinstatement when working on hydrocarbon equipment

4

Part 1 Contents Terms and definitions ............................................................................................................. 4 Introduction ............................................................................................................................ 5 Step 1 - Plan ........................................................................................................................... 7

Best practice – general principles ....................................................................................... 7

Requirements for the number of barriers ........................................................................... 8

Step 2 - Isolate ...................................................................................................................... 10 Best practice – general principles ..................................................................................... 10

Recommended practice for bleeding ................................................................................ 12

Step 3 – Execute (work on hydrocarbon equipment) ........................................................... 14

Best practice – general principles ..................................................................................... 14

Routines for sealing device selection, bolt tightening, etc. .............................................. 15

Step 4 - Reinstate .................................................................................................................. 17 Best practice – general prinsiples ..................................................................................... 17

Leak testing ...................................................................................................................... 17

Terms and definitions

Term Explanation

Work on hydrocarbon systems Work on piping systems, tanks and associated components which

could pose a threat of releasing produced oil/gas/condensate. The

term is used in a wide sense in this report, and includes planning,

isolation, intervention in the hydrocarbon equipment and

reinstatement.

Blinding Isolation with the aid of a full-specification spade or blind (blank

flange).

Spade A metal plate inserted between two flanges.

Double barrier and bleed This term is used instead of “double block and bleed (DBB)” in

this document, since the latter can be misunderstood.

Isolation Separating a plant and equipment from any and all energy

source, such as pressure, electricity and mechanical energy, in

such a way that the separation is secure.

Operational pressure Normal operating pressure. NB! This term is not used in the

same way in all the companies.

Positive isolation This term is not used in the report, since it can be misunderstood.

See blinding.

List of break sections A dynamic document which specifies at any given time which

points (both flanges and plugs) have been broken.

5

Introduction

Figure 1 presents the steps taken before, during and after work on hydrocarbon equipment.

These steps are used as the basis for describing best practice.

This figure and thereby the recommendations on best practice have been structured in such a

way that they coincide with the common guidelines for work permits (WP). See the document

Recommended guidelines for common model for work permits, revised in 2011, ref /1/. The

relationship between the recommendations and the general WP system is presented in figure

1. Put briefly, the relationship with the WP system is as follows.

Figure 1 starts with “isolation required”. This requirement will emerge from the planning of a

work operation on hydrocarbon equipment. Such work requires a level 1 WP, ref /2/. In other

words, the need for isolation is initiated by the WP system. Planning and isolation activities

are carried out thereafter as shown in the figure. A new interaction with the WP system occurs

in connection with the actual work on the hydrocarbon equipment. The WP system specifies

activities which must be conducted before the job can begin (a safe job analysis (SJA),

approval routine and so forth) and after the work has been completed (that the job is finished,

that the work site has been cleared up and so forth).

The starting point for the figure is that a need for isolation has been identified – in other

words, that work is to be done on hydrocarbon equipment. On the left-hand side are activities

to be performed before work on the hydrocarbon equipment can begin, and then those to be

performed to make sure that the isolations/barriers are correctly removed. Activities are

divided into four steps: planning, isolation, work (on the hydrocarbon equipment) and

reinstatement. Each of these main steps is broken down in turn into subsidiary steps. The

right-hand side of the figure shows who performs the various activities. These roles accord

with those described in the common model for work permits, ref /1/. Blue and red texts

indicate roles which are to function as independent barriers – in other words, the first role

(blue) will perform the activity with the second (red) checking that it has been performed

correctly. In such cases, making provision for the two roles to be executed independently of

each other is crucial.

The remainder of Part 1 reviews the steps in the above-mentioned figure. What each step

involves is explained first. The work group’s recommendations for best practice are then

presented.

6

Evaluate isolation needs/

requirements

Prepare isolation plan

Verify and approve isolation plan

Isolations required

Establish and leak test isolations +

purging

Verify isolations

Demonstrate zero energy – check

and prepare (interaction)

Work on HC equipment

Inerting and leak test

Verify removal of isolations and

reinstatement of break points

1 P

LA

N2

ISO

LA

TE

3 E

XE

CU

TE

4 R

EIN

ST

AT

E

Approve reinstatement

Re

insta

tem

en

t an

d

ve

rifica

tion

in p

ara

llel

Remove isolations

Approve isolations

Isolations removed

Area technician. A dedicated coordinator

where several disciplines are involved in

the isolation

Cooperation between several roles:

Area technician demonstrates to executing

skilled worker

See WP process

Area Technician

Area technician

Another competent person (normally

another area technician)

Another competent person (normally

another area technician)

Another competent person (area

technician/operations supervisor)

Area technician

Operations supervisor/Area technician in

cooperation with executing skilled worker

See WP process

Executing skilled worker

Area/operations supervisor

Operations Supervisor

Figure 1 Steps to be taken for isolation and reinstatement when working on hydrocarbon equipment.

7

Step 1 - Plan

Best practice – general principles

Subsidiary steps Proposed best practice

Evaluate isolation

needs/requirements

Optimum planning calls for the job to be planned in good

time, possibly from shore, and for the documents to have

been received/quality-assured before work begins offshore.

Well-defined boundaries must exist for what are regarded

as “normal” work operations, so that the boundaries for

what production technicians can do without an isolation

plan are not stretched.

Prepare isolation plan Standards must be set for preparing isolation plans.

Correct tagging of equipment is critical, since this is a

possible common error for otherwise independent barriers.

Routines must be in place to ensure that planning always

starts from the master P&ID, and no doubt must prevail

about the identity of the master P&ID at any time.

Should changes have been made by hand to the master

P&ID (in the control room), and a new master P&ID

arrives from shore, two people must check that the

document placed in the folder includes all the changes.

Whoever prepares the isolation plan must assure

themselves that the plant and the P&ID conform with each

other, and not rely exclusively on the master P&ID. In

complex plants, this should be doing by going out into the

field and checking the plant.

Companies must have clear guidelines for when single and

double barriers are to be used. Great variation exists

between the companies in this area. See the information

below.

The isolation plan must be structured as a checklist, so that

it is easy to follow.

The isolation plan must be specific on all the details

involved (all plugs, valves, etc.) for ensuring correct

reinstatement.

The isolation plan must be structured so that the user signs

for each point as the barriers are established. This reduces

the chance of missing out a point in the plan.

The isolation plan must specify which discipline team is to

perform each point in the isolation process. It must also

indicate whether support is needed from personnel with

specialist expertise.

It must be possible to test all barriers in the direction of

flow the barrier is supposed to protect against. A specific

description must also include how the test is to be

performed. If one side of a valve is not pressurised, a

requirement to pressurise it should be included so that the

test can be carried out. Certain exceptions can be made for

8

systems which are not normally pressurised and which are

impossible to pressurise in practice. Specific guidelines

must be prepared for such exceptions.

The isolation plan must show which barriers are to be

tested, and a tick box provided for each test to record that

it has been done. An overview must also be provided of

which flanges have been broken during leak tests. This is

handled by updating the list of break sections.

Should an isolation plan be re-used for a later job, it must

be verified anew.

An assessment must be required to determine whether a

special sequence is to be followed when establishing

barriers and during reinstatement.

Verify and approve isolation

plan

Verification must include a check that the isolation plan is

sufficiently detailed and specifies, for example, all bleed

points and all flanges to be broken during testing. If this

requirement is not met, the plan must be rejected.

All relevant documentation, such as P&IDs, must be

included in the verification.

The person verifying the isolation plan must be involved in

the field. (They cannot be someone who normally works at

an office.)

Independent verification of the isolation plan must be

performed by a competent person. This must not be the

same person who has prepared the plan.

Specific requirements must be set for the expertise of

personnel who are to verify and approve isolation plans.

General A process system audit must be conducted at regular

intervals to identify errors in P&IDs.

Instructions must be established for the action to be taken

if a tag number is found to have fallen off. This routine

must include an independent check of the placement, so

that a single error cannot lead to the tag number being

placed on the wrong equipment.

Requirements for the number of barriers

Practice varies between the operator companies with regard to the number of barriers required

for isolation when working on hydrocarbon equipment. Tables 1 and 2 present examples of

requirements set by five operators on the NCS. The first table relates to cases where the work

site is periodically left unstaffed, while the second relates to sites involving short exposure

with personnel present at all times.

Note that the three companies with operational pressure as the pressure reference in tables 1

and 2 had different definitions of the concept. Company A: “PSV pressure. The equipment’s

design pressure or the highest pressure which can occur”. Company B: “The pressure which

the system normally operates in”. Company C: “The maximum pressure that can occur in the

pipe system. Normally confined by PSHH and/or PSV”.

9

Table 1 Requirements for the number of barriers when isolating if the worksite is periodically left unstaffed.

(Some of the requirements have been simplified.) The final column in the table specifies the pressure concerned (see

first row).

Operator <10 bar 10-50 bar 50-100 bar >100 bar Pressure reference

Company A Single barrier. Double

barrier/blinding if

personnel change

Double barrier/blinding. Single

barriers can be approved under

certain circumstances

Double

barrier/blinding

Barg operational

pressure

Company B Single barrier Double barrier Barg operational

pressure

Company C Single barrier Double barrier/blinding Barg operational

pressure

Company D (<20 bar)

Single barrier

(>20 bar)

Gas: single barrier

Liquid: double barrier

Double barrier Pressure class

(converted to

operational

pressure)

Company E Single or double barrier/blinding depending on substance

type, situation, effect matrix, release matrix, time factor

and hazard factor

Double barrier Design pressure

Table 2 Requirements for the number of barriers when isolating for short exposure with personnel present at all

times. (Some of the requirements have been simplified.) The final column in the table specifies the pressure concerned

(see first row).

Operator <10 bar 10-50 bar 50-100 bar >100 bar Pressure reference

Company A Single barrier

Double barrier Barg operational

pressure

Company B Single barrier Single barrier

(up to 16

hours)

Single barrier (up to three hours) Barg operational

pressure

Company C Single barrier Double barrier Barg operational

pressure

Company D (<20 bar)

Single barrier

(>20 bar)

Gas: single barrier

Liquid: double barrier

Double barrier Pressure class

(converted to

operational

pressure)

Company E Single or double barrier/blinding depending on substance

type, situation, effect matrix, release matrix, time factor

and hazard factor

Double barrier Design pressure

Best practice – number of barriers

The companies must assess whether their own requirements are sufficiently stringent in

light of tables 1 and 2 above.

The term “double barrier and bleed” is recommended in preference to “double block and

bleed”, since the latter can be misunderstood.

Avoid the term “positive isolation”, since this can be misunderstood. Preferably use the

term “blinding”.

In practice, it is difficult for offshore personnel to determine which valves have a double-

barrier function. An overview (quality-assured by a valve expert) of valves which have

this function, with tag numbers, should accordingly be available for each

platform/facility. This overview will form the basis for preparing isolation plans. NB! It

is not sufficient to check that the valve is described as DBB. Suppliers should be required

to provide appropriate function labelling on new valves.

In order to have two barriers which count as such, it must be possible to test them both

independently of each other. See section 5 of the management regulations, ref /9/.

10

Step 2 - Isolate

Best practice – general principles

Subsidiary steps Proposed best practice

Establish and leak test

isolation + purging

Start-up

Requirements must be established for conducting these

activities – in job instructions or method descriptions, for

instance.

It is important that somebody is responsible for process

isolation, and that this person approves the start of

isolation. This person will also coordinate the sequence of

activities if several people are responsible for the isolation

job.

The people doing the job must discuss and understand the

underlying philosophy of the isolation plan before starting

work. This could be accomplished, for example, by the

responsible operations supervisor going through and

explaining the plan to the relevant personnel.

Execution

A physical barrier must always be in place to prevent

actuator-controlled valves from changing position. The

isolation method must be sufficiently secure to provide

assurance that for example a loss of power or air will not

change the valve position.

Because of the above, a quality-assured overview with tag

number showing how each valve is to be isolated should be

available for each individual platform/facility. This

overview will form the basis for executing isolations.

Tagging campaigns. Ensuring that all equipment – not only

valves, but also connections and other relevant items – is

tagged represents a crucial requirement. Tagging

campaigns should accordingly be pursued. This work can

possibly be outsourced to contractors.

Consequences of missing tags. A lack of tagging should

generate a requirement for physical checking of the plant.

This must be done by at least two people.

Setting specific expertise requirements for those doing the

isolation is important. (Similar requirements must apply

for those verifying isolations.)

If isolation and leak testing are conducted in parallel, these

activities must be performed systematically (finishing

work on one barrier/component before continuing to the

next).

A system must be in place for labelling the involved

equipment, checking that isolation has been carried out and

has not been altered by others.

- Labels must be hung on the equipment as the isolation

process proceeds. A system must be in place to ensure

that the quantity of labels and the number on each

11

accords with the isolation plan. This will help to

ensure that no items on the plan are overlooked.

Example: a dedicated printer connected to the WP

system.

- Locking. Some companies have routines for locking

valves so that their position cannot be inadvertently

changed by others (see below).

Isolation should be carried out at a time when sufficient

peace and quiet prevails for a thorough job to be done.

The list of break sections must be updated if breaking of

flanges or removal of plugs forms part of the isolation

process. This list must be a dynamic document which

specifies at any given time which points (both flanges and

plugs) have been broken.

Purging

Purging should always be done before work starts on

hydrocarbon equipment. That also applies to work on

safety valves.

Bleeding

Common specifications should apply for all hoses, so that

using the “wrong” one will not have significant

consequences.

Requirements must be set for the way the hose ends are to

be secured so that they do not dance around in the event of

a leak.

Proposals on best practice for bleeding have been prepared

(see below).

Criteria on what is to be regarded as a safe area for

bleeding must be prepared for each facility.

Verify isolations Requirements must be established for the way verification

is to be performed.

Verification must always be required, even if the isolation

only embraces a few valves.

Measures to ensure that the verifier is conscious of their

role are recommended. Efforts must be made to achieve

the best possible verification. (How this can be done is

described in Part 2.)

Approve isolations It is important that the responsible operations supervisor

has expertise about the systems involved in the isolation.

Examples of checkpoints which the responsible operations

supervisor must verbally ensure have been performed are

provided in an appendix to this document.

Demonstrate zero energy –

check and prepare

(interaction)

Routines must be in place to demonstrate zero energy for

the person who is to do the job. This involves, for example,

demonstrating that the system is depressurised by opening

and closing a valve, trying to start pumps which have been

disconnected and which form part of the isolation, and so

forth.

12

Recommended practice for bleeding

Recommended practice for bleeding is shown in figure 2 below.

Is a technical system available

which has been designed and

approved for connecting bleed

hoses

Identified need to bleed

More detailed assessment

needed before job can begin

Closed bleeding with

manometer is the basic

recommendation. Is this

considered appropriate?

Carry out risk assessment. Are

hoses acceptable? Where will

they be conducted?

NO

Hoses not acceptable

(or unclarified)

NO

NO

Use hoses in accordance

with applicable guidelines

YES

Hoses acceptable

Use closed bleed with

manometer. Check pressure

build-up regularly

Use the technical system in

accordance with applicable

guidelines

YES

YES

Figure 2 Flow diagram for bleeding, best practice.

Initial assessment. Is a technical system available which has been designed and approved for connecting bleed

hoses? Each company must assess which systems these could be. If yes, use this system.

Second assessment. Using a manometer to detect pressure build-up: either continuous pressure monitoring with an

alarm or an operator who checks the manometer periodically – every four or six hours, for

example. However, note that technical equipment able to detect pressure build-up

automatically exists, and has been adopted by some companies. Automated detection of

pressure build-up with alarms is regarded as a more robust solution than taking readings

manually from a manometer at regular intervals. An example of automated equipment is

presented in ref /11/.3

3 The possibility exists for technological development here. Proposal: a manometer which measures pressure

build-up and which gives an alarm both audibly and by flashing lights in the event of pressure build-up – to two

13

Should a manometer be used, it must have the same pressure class as the piping system while

still being able to detect small pressure build-ups. See moreover The safe isolation of plant

and equipment, page 37, ref /10/.

Closed bleeding with a manometer is conditional on:

the valves being tested

a plan for what is to be tested, how, by whom and when

a plan for the response to a pressure build-up.

Third assessment. A hose open to the air can be used in certain cases, but only if a risk assessment finds it

acceptable. As a minimum, the hose must:

be of a type able to cope with the highest pressure class on the facility (so that it can

cover all applications, and a mix-up has no serious consequences)

have connections of the right type, which are firmly attached

have its free end secured

be undamaged (without cracks, blisters or tears)

be clean and ready for use

be correctly tagged with certificate/reference number.

The above-mentioned risk assessment must form part of preparing the isolation plan. This

means that each point in the plan must be gone through and a risk assessment conducted to

establish how bleeding is to be implemented – including what constitutes a secure area for

conducting open hose ends.

What constitutes a secure area for conducting open hose ends This must be evaluated in each case through a risk assessment. The following should be taken

into account.

The term “secure area” is not the same as “unclassified area”.

A “secure area” means one without ignition sources and which does not expose personnel

to vapour or any undesirable medium. The secure area must be defined in each case.

Positioning a vent must take account of air intake, HVAC outlets, combustion air and

personnel exposure.

Fluids must primarily be bled to an enclosed drain or other closed system suited to the

purpose.

Wind direction must be taken into account when positioning a vent, so that gas is not

blowing into staffed areas, possible ignition sources, and ventilation intakes. The solution

chosen should preferably be robust for all wind conditions.

Labelling and securing equipment included in the isolation

Established colours must be retained.4 In addition to the colour, however, written details

on the label must clearly identify what the colour means – “Closed valve”, “Open valve”,

“Do not operate” and so forth.

Labels must also include other relevant information, such as the valve and blind number

and the tag number.

bar, for example. Possibly a wireless manometer. It is important that this type of equipment can withstand high

pressure but nevertheless detect small pressure changes. 4 Practice on labeling equipment included in an isolation varies from company to company. See Part 2 for

examples.

14

A system must be in place to identify the correct work site (break or cut point). See the

“green label” used in one company. This hangs together with the “demonstrate zero

energy” step in the flow diagram. See the “isolation” step.

Example of good practice – locking valves included in the isolation

Some companies have introduced a system where the operations supervisor and the executing

skilled worker have separate keys to a box which contains the keys for the isolations. Both

must use their keys before reinstatement is possible. The companies concerned report positive

experience with this system.

Step 3 – Execute (work on hydrocarbon equipment)

Best practice – general principles

Subsidiary steps Proposed best practice

Work on HC equipment Related to execution

Good routines for ensuring that the correct torque (correct

bolt torque table) has been applied are important.

Requirements must be established for verifying that the

correct torque has been applied.

Routines must be in place for ensuring that the correct

sealing devices are used.

Requirements must be established for verifying that the

correct sealing devices are used (workmate check of

sealing device chosen).

The list of break sections must be updated for each flange

broken and each plug removed. This list must be a

dynamic document which specifies at any given time

which points (both flanges and plugs) have been broken.

Other aspects related to planning/general considerations

Routines must be in place to ensure that no other work

involving ignition sources is taking place in parallel.

An overview of bleed points per module must be

established. This should be checked against potential

ignition sources.

Requirements should be established for demonstrating zero

energy when changes of personnel take place – between

day and night shifts, for example.

Paying attention to the design and use of bolt torque

tables/labels is important. Labelling requirements.

Requirements must be established for courses/training.

Also applying these requirements to personnel on shore

who work on equipment for delivery to offshore facilities

is important.

Labelling equipment to be removed is recommended if the

removal occurs on a live platform. Cold cutting should be

limited on a live platform. Requiring that workers report to

the area technician each time they leave the work place is

recommended. See the “demonstrate zero energy” step.

15

Companies must ensure that the recommendations in

Norsok L004, ref /12/, have been applied.

Investigation of faults detected in a leak test is

recommended. This will improve understanding of what

goes wrong with such jobs and leads to leaks.

Routines for sealing device selection, bolt tightening, etc.

Figure 3 presents various steps which could lead to a flange-related hydrocarbon leak if they

are not performed correctly. The text under the figure details best practice for each of these

steps.

a) Prepare and verify bolt torque

table

b) Select the correct bolt torque table

and use/understand this

c) Reassemble broken flanges and

tighten bolts to the correct torque

d) Verify that these steps have been

correctly performed

Figure 3 Steps performed to ensure that broken flanges are reassembled correctly and bolts tightened to the correct

torque

a) Prepare and verify bolt torque table The piping specification to be chosen for each relevant application must be determined

by a multidisciplinary team.

Preparation of the bolt torque table must be verified by an independent competent person.

b) Select the correct bolt torque table and use/understand this Selection of the bolt torque table is determined by the piping specification shown in the

P&ID. It is important that routines for selecting the table are designed to that picking the

correct one is easy and that opportunities for misunderstandings are avoided.

It is crucial that the tables are designed to suit the tools to be used and to be read off

directly. Conversion from table to tool must be unnecessary, or a source of error would

be introduced which might mean all bolts have the wrong torque.

c) Reassemble broken flanges and tighten to the correct torque The work must be performed as described in Håndbok for flensarbeid, ref /13/.

Routines must be established for periodic (annual) calibration of torque tools. That

applies to both hydraulic and manual types.

As a general rule, new bolts must be used when assembling the equipment (no re-use of

old bolts). This accords with chapter 2.5 in ref /13/. See also the recommendations in

ASME PCC-1, Appendix N, ref /14/. Galvanised bolts must always be replaced, since

galvanisation on the old bolts will usually be worn. That affects the friction factor and

thereby the necessary torque. Bolts in stainless steel can be reused, providing the threads

16

are checked to ensure that no damage has occurred. See moreover ASME PCC-1,

Appendix N, ref /14/.

Choice of gasket type must always be based on the specification. See labelling on the

gasket/packaging. Another competent person must verify that the correct gasket has been

chosen.

Best practice for gasket material can change over time.5 However, it is important that the

mechanic always replaces a gasket with the type stipulated in the specification and does

not change this on their own initiative. That is because a change of gasket type means the

whole specification must be updated, including bolt length, bolt torque table and other

elements.

All flanges in hydrocarbon systems, regardless of size, must be tightened with a torque

wrench/tool.6 An adjustable spanner must never be used.

In the event of misalignment: treated as a nonconformity in accordance with the

management system. Tolerances are specified in Norsok L004.

d) Verify that these steps have been correctly performed.

Performance of the points above must be verified by another competent person

(mechanic) before the equipment is reassembled. The verification must include seal

surfaces, cleaning, choice of gasket, bolts and bolt torque table, and torque. This also

applies to preparation activities. An itemised list must be prepared for everything to be

checked.

Verification must also include a check that the correct plug has been used and that it has

been tightened with the correct torque.

Verification must be performed immediately before/at the same time as the flanges are

reassembled. It will not be possible to verify the above-mentioned points after the job has

been done.

The problem of different gasket colours Gaskets currently come in different colours without these having been systematised by the

manufacturers. Should they be (erroneously) regarded as a colour coding by the mechanic and

the person verifying the choice of gasket type, misunderstandings could arise which lead to

the incorrect gasket being installed. The following measures are recommended.

Explain that colour is not a valid means of identification when selecting gaskets.

Require mechanics to read what is stated on the packaging and to understand what that

means. The correct type of gasket is then chosen on the basis of the pipe specification.

Choice of gasket must be verified by another competent skilled worker.

Work to ensure that all gaskets have the same colour, so that nobody can erroneously

believe a colour coding is involved.

5 A recommendation to cease using graphite laminate gaskets in hydrocarbon service is under consideration, for

example. 6 Chapter 6.5 of Norsok L004, ref /12/, states: “All bolted flange connections shall have controlled tightening by

means of manual torque wrenches or hydraulic bolt tightening. Hydraulic bolt tightening (tension or torque) shall

be used on all bolts greater than 25.4mm (1in) diameter. If required the bolts shall have extra overlength of

1xbolt diameter in order to accommodate tensioning tool.”

17

Step 4 - Reinstate

Best practice – general prinsiples

Subsidiary steps Proposed best practice

Approve reinstatement Signature on the completion of work on the

hydrocarbon equipment.

The responsible operations supervisor must give written

permission for reinstatement to begin.

Requirement to assess whether a special sequence is to

be followed for reinstatement.

Inerting and leak test Purging/inerting

Inert with nitrogen (N2) and measure oxygen (O2)

content in the substances blown out. Reinstatement can

begin when the O2 content is below four per cent.

Final overall check by the area/responsible operations

supervisor that this and other preparatory steps have

been taken.

Leak test

Observe best practice (see text below).

Assess the use of Kamos7 gaskets or corresponding

solutions against unpressurised systems, such as the

flare.

Remove isolations Routines for following the valve and blind list

systematically are important. Sign for each item

removed.

It is also important to check that all flanges and plugs

which have been broken/removed are reinstated. See the

items on the list of break sections.

Routines for final opening of interfaces with pressurised

systems.

Routines must be established for counting labels and

checking that they are all in place.

Verify removal of isolations

and reinstatement of break

points

Routines for verification of removals/reinstatements by

a competent person.

Check each item on the valve and blind list. Each item

must be signed to show that verification has been done.

Signed verification that all break points on the list of

break sections have been reinstated (see information in

the appendix). The list must be a dynamic document

which specifies at all times which points have been

broken (both flanges and plugs).

Leak testing

Attention in this project is concentrated on hydrocarbon leaks related to work with

hydrocarbon equipment on offshore facilities. The decision has accordingly been taken to

7 A type of gasket which can be leak tested without pressurising the adjacent segment. The test is conducted by

applying pressure to the gasket.

18

concentrate on leak testing rather than pressure testing. On that basis, best practice is

discussed for the following test methods.

Gross leak test A gross leak test at relatively low pressure (normally below seven to 10 bar): “use what

you’ve got”.

The test is normally conducted with nitrogen.

Soap test of flanges.

Taping can be appropriate for some flanges. Holes are then punched in the tape and

evidence of leaks sought at that point.

Monitoring pressure over time is not normal practice with this test.

The test is normally conducted with the facility’s own equipment.

Sensitive leak test

Nitrogen blended with one-two per cent helium is used.

Flanges are taped, holes are punched in the tape, and a measuring device indicates

whether the equipment is leaking. This device sniffs for helium. Detection of helium is

the test criterion, rather than pressure monitoring over time.

The system is pressurised to test pressure.8

The test is normally conducted by a contractor.

A variant: a high pressure test is conducted with nitrogen in some places if helium is not

available. This can be an alternative to a sensitive leak test in some cases.

In-service leak test Gradual pressurisation with the process medium – in other words, the latter is used as the

test medium.

Example: pressurise in steps of 20 per cent of operating pressure, alternatively 10 bar at a

time.

Check for leaks along the way until the plant/equipment has reached normal operating

condition (pressure/temperature).

The flow diagram in figure 4 shows when the various test methods are relevant.

8 At the time of writing (October 2012), the companies are collaborating through the Norwegian Oil and Gas

network on hydrocarbon leak reduction on what is to be regarded as an appropriate test pressure. The

recommendation from that work will be implemented in future revisions of this document when it is ready.

19

Assessment of which test

method(s) is/are to be used

Identified need for leak test

Gross leak test

Own personnel/

maintenance

Major jobs/

separate projects

Simple system with little

volume and few flanges

Sensitive leak test (N2/He)

Gross leak test

In-service leak test In-service leak test

Figure 4 Flow diagram for choice of test method

Use of in-service leak tests without performing a gross leak test first should be limited, and

should only be used on simple systems involving little volume and few flanges. If provision is

made for connecting a nitrogen supply, the gross leak test should be conducted.

Main principles for testing

All barriers included in the isolation must be tested in the correct order.

Valves should not be operated after they have been tested.

Tests must be conducted in a way which avoids trapping pressure – in the housing of

large valves, for example.

Where double barriers are installed, the last barrier must also be subject to a low-pressure

test. This is because certain valves can seal well at high pressure, but nevertheless leak at

low pressure.

More detailed information on testing procedures is presented in Part 2 of this document.

20

PART 2: Background for the recommendations in part 1

21

Contents Part 2 The key reasons for hydrocarbon leaks ................................................................................ 28 On steps 1-4 presented in Part 1 ........................................................................................... 31 On step 1 - plan .................................................................................................................... 32

What this involves ............................................................................................................ 32

Why it is important ........................................................................................................... 33

On step 2 - isolate ................................................................................................................. 34 What this involves ............................................................................................................ 34

Why it is important ........................................................................................................... 36

On step 3 – Execute (work on hydrocarbon equipment) ...................................................... 39

What this involves ............................................................................................................ 39

Why it is important ........................................................................................................... 40

On step 4 – reinstate ............................................................................................................. 40 What this involves ............................................................................................................ 40

Why it is important ........................................................................................................... 41

22

Background

An offshore facility contains large quantities of hydrocarbons under pressure. Should a leak in

process equipment cause hydrocarbons to become mixed with air, a fire or explosion may

result. This could have serious consequences for people on the facility, the natural

environment and the facility itself – and ultimately for the company involved. In other words,

a hydrocarbon leak has a potential to become a major accident. Activities in order to prevent

such leaks occurring represent an important contribution to reducing major accident risk.

Figure 5 presents various barrier functions which contribute to preventing/reducing major

accident risk related to releases in the process area on offshore facilities. Preventing

hydrocarbon leaks is the first of these functions, and is the exclusive concern of this report.

Figure 5 Barrier functions for preventing major accidents related to hydrocarbon leaks from process plants. This

report concentrates solely on the first of these – preventing hydrocarbon leaks.

A typical offshore facility with process plant contains several hundred tonnes of hydrocarbons and

several thousand possible leak points in the form of flanges, valves and so forth.

Figure 6 presents the annual number of hydrocarbon leaks on the NCS larger than 0.1kg/s.

The trend for such leaks has been positive since the mid-1990s, with the number declining

from 42 in 2000 to 10 in 2007, ref /1/. However, the annual figure varied between 11 and 16

in the subsequent four years. To reduce major accident risk, the industry wants to achieve a

further reduction in hydrocarbon leaks. A hydrocarbon leak reduction project was accordingly

launched in the spring of 2011. This report documents one of the activities conducted as part

of that project.

23

Figure 6 Hydrocarbon leaks larger than 0.1kg/s from process plants on Norwegian offshore facilities in 1996-2011.

Why has it been decided to concentrate on hydrocarbon leaks larger than 0.1kg/s? Reasons include

the fact that such leaks have the potential to cause a major accident if the hydrocarbons ignite. The

higher the release rate, the more serious the consequences could be. Examples of what a 1kg/s leak

could cause include: Unignited leak: release of toxic gas which fills most of an offshore module in seconds. Taking

two-three breaths of this gas could cause loss of consciousness because of its narcotic effect.

Immediate ignition: a jet fire with flames up to 12-15 metres long. Possibilities of escalation if

the flames reach other process equipment or structures without passive fire protection.

Delayed ignition: explosion with deadly overpressure in the whole module. High probability of

a subsequent fire, and a possibility of escalation to other equipment/areas.

A leak of 1kg/s corresponds to emptying a full gas cylinder of the type used for gas-fired barbecues

and the like (see illustration on the left) in 10 seconds. With a leak of 0.1kg/s, such a container would

be emptied in 100 seconds – in other words, a little over 1.5 minutes.

A causal analysis for 2008-11, ref /3/, has shown that a significant proportion of the

hydrocarbon leaks relate to human and operational errors when planning work on process

equipment, executing this work and reinstating the equipment in order to restart the process

plant. Good routines/work processes and an understanding of the necessity for planning,

execution and reinstatement when working on hydrocarbon equipment are important

requirements for successfully reducing the number of hydrocarbon leaks.9 A recognition of

this forms the background for the work documented in this report.

What ranks as a major accident

Several definitions of the major accident term exist. The following wording is used on the

PSA website, ref /4/:

9 Other factors are also important for reducing the number of such leaks, including design, management aspects,

training/expertise and maintenance. See in this context other activities in the hydrocarbon leak reduction project

as well as internal projects at each operator.

24

“A major accident is an acute incident, such as a major discharge/emission or a fire/explosion,

which immediately or subsequently causes several serious injuries and/or loss of human life,

serious harm to the environment and/or loss of substantial material assets.”

Observing work routines for tubing is as important as for large-diameter piping. A leak point of a few

millimetres releases enough gas to cause a major accident.

Why preventing major accidents is important

A major accident can have very serious consequences. That has been clearly demonstrated by

several incidents around the world in recent years – not least the Macondo accident in the

Gulf of Mexico during 2010. So working purposefully to avoid such incidents is important. A

release of 1kg/s can be used as an example of the serious consequences which could follow

from a hydrocarbon leak. The NCS has witnessed this size of leak every single year10

for

which reliable data are available.

To prevent ignition, EX-proof equipment is installed in the process area. Potential ignition

sources (rotating machinery and so forth) are also automatically disconnected if gas is

detected. However, the fact remains that a hydrocarbon leak can also be ignited by static

electricity, the energy in the actual fracture or other factors outside human control.

The best way of ensuring that a leak does not cause a major accident is accordingly to prevent

one happening at all.

What is the biggest difference in risk terms between work accidents and hydrocarbon leaks? The

potential consequences are completely different. A work accident could mean that you and/or a fellow

worker are injured or, in the worst case, killed. However, an ignited hydrocarbon leak could result in

that many of those present on the facility are injured or killed. With work accidents, the risk you expose

yourself to is often easy to grasp – you can fall from a ladder, you can drop an object on a colleague,

you can fall from scaffolding. Errors made when working on hydrocarbon equipment can have much

greater consequences than a work accident, but this is not always easy to see and understand. Examples

of errors which could cause a major accident include the following.

You fail to check the specification, and accordingly install the wrong gasket after replacing a

valve. Verification (workmate check) that the right gasket has been chosen is dropped. The result

could be a major accident.

You misread the bolt torque table and tighten flange bolts with the incorrect torque. Verification

(workmate check) of the tightening is dropped. The result could be a major accident.

You fail to comply with the valve and blind list when isolating or reinstating process equipment,

and the workmate who has been given the job of double-checking that you have done everything

correctly fails to conduct this check as they should. The result could be a major accident.

As the responsible operations supervisor, you sign that reinstatement and verification have been

carried out without having assured yourself that this is actually the case and checking how it has

been done. The result could be a major accident.

The most serious accident so far in the North Sea occurred in 1988 on the Piper Alpha

platform on the UK continental shelf, ref /8/. A total of 167 people died in this accident, or

10

However, no hydrocarbon leak has ignited on the NCS since 1992.

25

more than two-thirds of those on the installation. Part of the sequence of events is detailed

in table 3.

Table 3 Course of events in the Piper Alpha accident, when 167 people died as the result of a

hydrocarbon leak, ref /5/. Time Description

12.00 The platform had two condensate pumps, A and B. On the morning of 6 July 1988, a safety valve

(PSV no 504) was removed from pump A for routine maintenance and replaced by a blind flange.

The on-duty engineer noted on the work permit that pump A had been removed for maintenance

and must therefore not be started.

Plans also called for an overhaul of the pump, but that work had not yet begun.

18.00 The day shift ended, and the night shift took over. Since one of the people coming on duty was

otherwise engaged, no information on the status of pump A was provided at the change-over. The

work permit with the notation that the pump must not be started was placed in the control room.

This permit disappeared and was not found by the operator on the night shift. However, the

control room had another work permit concerning pump A since a general overhaul was planned

which had not started.

19.00 As on many other platforms, Piper Alpha had an automated firewater deluge system driven by

both diesel and electric pumps (the latter were put out of commission by the first explosion). The

diesel-driven pumps were designed to start automatically on fire detection. However, they had

been placed in manual mode on the evening of 6 July because divers were in the water and could

in theory be sucked into the seawater intake if the fire pumps started.

21.45 Condensate pump B stopped suddenly and could not be restarted. The workers had only a few

minutes to get one of the pumps going again before the power supply failed. Available work

permits in the control room were scrutinised to see if pump A (which had been removed for

maintenance) could be started up instead.

21.52 The work permit for overhauling pump A was found, but not the one (for removal of the PSV)

which stated that the pump must under no circumstances be restarted. The PSV was located in a

different area than the pump and, since the permits were kept in different boxes depending on

location, none of those involved on the night shift were aware that an intervention had been made

in the hydrocarbon equipment. Based on the work permit about the general overhaul, starting

pump A was assumed to be safe. Nobody noticed the missing valve, temporarily replaced by a

blind flange, because it was located several metres above the deck and hidden by other

equipment.

21.55 Condensate pump A was started. That caused the temporary blind flange to be blown off. Soon

after the start-up, personnel could hear a gas leak and six gas detectors were activated. Before

anyone managed to react, however, the hydrocarbons ignited. An explosion caused a further leak

in another condensate pipe and a large subsequent fire. After the accident, the size of the initial

leak was estimated at about 2kg/s with a total release of some 70kg.

22.04 The control room was evacuated without sounding the muster alarm. People on board sought to

reach the lifeboats, but were prevented by the fire. Instead, many chose to muster in the living

quarters and await instructions on what to do. Wind, flames and smoke made it impossible to land

helicopters, and no further instructions were given. After a while, smoke began to enter the living

quarters. Two people in smoke diving gear tried to reach the control panel for the fire pumps

beneath the deck in order to activate the deluge, but were never seen again.

The hydrocarbon fire might have gone out of its own accord had not two of the neighbouring

platforms (Tartan and Claymore) continued to pump hydrocarbons into the shared pipeline. Their

failure to cease production reflected the fact that the offshore managers were not permitted to shut

down without permission from shore, while they were also ignorant of the position on Piper

Alpha.

22.20 The fire spread to one of the risers (towards Tartan), resulting in a gas leak at a rate corresponding

to a third of the UK’s total gas consumption by households. This caused a huge fire, 150 metres

in diameter, which enveloped the whole of Pipe Alpha.

22.30 Standby rig Tharos, located adjacent to Piper Alpha, tried to douse the fire with water monitors.

However, the effect was limited.

22.50 The fire spread to the other riser, and millions of litres of gas were released. The flames shot more

than 90 metres into the air. It was only then that Claymore ceased to pump oil into the pipeline.

26

23.20 The riser to Claymore collapsed.

23.50 The part of the platform on which the living quarters stood fell into the sea.

12.45 next

day

The whole platform had vanished into the sea.

The BBC has produced an informative documentary about the Piper Alpha accident entitled

Spiral to disaster, ref /6/. This programme has been released on DVD and can be purchased

from BBC on the internet.

The direct cause of the Piper Alpha accident was that the isolation was broken while work was under

way on the hydrocarbon equipment. The initial leak rate was approximately 2kg/s, with a total

hydrocarbon release of about 70kg. Hydrocarbon leaks on this scale have been experienced in most

years on the NCS, but fortunately without igniting.

?

Which of the jobs done by you or the people you supervise could end up as a major accident if they are

not done correctly? Think through three things you could do differently or pay extra attention to from

today in order to prevent a major accident.

How major accidents can be prevented

A background story: “Coffee will soon be ready ...”

Ola is a process operator on a North Sea platform. Like most Norwegians, he likes coffee and

is accordingly the proud owner of a machine which gets frequent use during his free time. If

there is one thing Ola knows how to do, it is making coffee. He does it many times every

single day. His expertise is first-class. Ola also has long experience. He has made coffee

every single day since he was a teenager. This is also a very simple job. All you have to do is

fill the reservoir with water, put coffee grounds in the filter positioned over the pot, open the

valve on the filter holder and press the start button. The machine does the rest. And, since Ola

is a careful and responsible person, all the conditions are right for faultless coffee-making –

every single time.

One morning, however, Ola goes to fetch his first cup of the day and finds that a mix of fresh

coffee and spent coffee grounds has flooded over the work top and onto the floor. It turns out

that he has forgotten to open the valve on the filter holder, causing the water to overflow from

the filter. “How’s that possible,” Ola thinks to himself as he cleans up the mess.

When the coffee is finally ready, Ola seats himself comfortably in his favourite chair and

reflects on why he forgot to open the valve – when he has done it right so many times before.

How is it possible? He goes on to think about his job in the North Sea – given that he forgot

to open a single valve on his coffee-maker, he could also probably overlook one of the valves

when he isolates process equipment offshore. After all, systems on the NCS are a good deal

more complex than in a coffee-maker. And, of course, the consequences of such an error

could be huge.

Ola has discovered an important fact: everyone makes mistakes from time to time, even if

their expertise, experience, training, concentration and so forth are excellent. It is perhaps

particularly easy to go wrong in routine jobs – ones you do again and again – because you get

used to everything going well. So paying greater attention is not enough for avoiding

27

mistakes. Routines must be structured in such a way that serious consequences are avoided

even if an individual commits an error now and then. One way of doing this in practice is to

have checklists to reduce the chance of errors, and to ensure that several people check the

same things independently11

of each other in order to pick up errors before they lead to

major consequences.12

An example of checklists is a valve and blind list. An example of an

independent check is another competent person verifying that the isolation plan is correct, that

the isolations/barriers have been correctly implemented and that everything has been properly

reinstated before the process plant is restarted.

Such working methods are a matter of course in the aviation industry. Scheduled flights

always have two pilots, who run through a checklist before every take-off – even when things

are busy. Pilots are unlikely to drop the checklist because the plane is late, for an obvious

reason: any error can lead to a crash and the loss of many lives. The major accident potential

is easy to see. But everyone working in the oil and gas industry must recognise that some jobs

are just as critical as work in the aviation industry. If you forget to reset a valve or to

tighten the bolts on a flange to the right torque, and this goes unnoticed, the result could be

another Piper Alpha. That is a reality everyone working on a process plant must accept.

?

Which of the jobs done by you or the people you supervise involves a checklist in one form or another?

Which of your jobs requires that two or more people check the same things? How is this check carried

out in practice? How can you help to ensure that the two checks are as independent of each other as

possible?

Ola makes on average one serious mistake every 100 times he performs a task. Suppose that we then

assign another person (Petter) to check what Ola has done, and that Petter also makes a serious mistake

every 100 times. How much “better” has the system become because Petter is checking what Ola has

already done? Twice as safe?

The answer is that the effect of a double barrier is much larger than that. Assuming that the two barriers

are independent – in other words, Petter does his job as well as he can even though he knows that Ola

has also just checked it – the system becomes 100 times “safer”. The probability of error rises from

1:100 to 1:10 000.

On average over recent years, a Norwegian offshore facility has experienced roughly one hydrocarbon

leak greater than 0.1kg/s every fifth year. With three shifts on each platform, this means that you will

personally experience a hydrocarbon leak once every 15 years if you represent the average. The

industry’s goal is to reduce the number of leaks even further. Can you honestly guarantee that you will

never make an occasional mistake – let us say once every 15 years? No. This means that independent

checks are necessary for critical tasks where an error could lead to a major accident.

The fact that the present average is one error every 15 years also makes the claim that “things usually

go well” meaningless. No individual has sufficiently long experience offshore to be able to draw such a

conclusion.

11

See the discussion under “step 2 - isolation” on how independent verification can be conducted. 12

An alternative/supplementary strategy is to design a plant to reduce the possibility of error or to limit the

consequences of errors. This can be a good strategy when planning new offshore facilities. For existing facilities,

however, it will be unrealistic in many cases to convert/modify large parts of the process plant.

28

Active use is made of safe job analysis (SJA) by all operators ahead of assignments in order to identify

“things which could go wrong” (undesirable incidents) and measures which should be taken to reduce

risk. However, an SJA is not particularly suitable for identifying major accident risk. Leistad and

Bradley, ref /7/, have carried out a study where a fictional SJA was conducted as part of a course. The

job to be risk-assessed involved replacing a valve in a hydrocarbon line. The course was given several

times with a total of 250 participants. All the SJA meetings identified potential work accidents, such as

dropped objects, crush injuries and so forth. However, none of the SJA groups identified errors

critical for major accidents – such as hydrocarbon leaks resulting from incorrect choice of gasket,

failure to lubricate bolts, and tightening the latter with the wrong torque.

The key reasons for hydrocarbon leaks

A total of 56 hydrocarbon leaks larger than 01.kg/s occurred on the NCS between 2008-11.

An analysis was conducted to clarify the reasons for these incidents, refs /3/ and /15/.

Important findings from the causal analyses include:

most hydrocarbon leaks larger than 0.1kg/s occur during normal operation rather than

shut down periods.

most hydrocarbon leaks occur in connection with human intervention in process

equipment – in other words, human error during preparation/isolation, work on

hydrocarbon equipment, and reinstating after completion of the job

technical defects in the equipment account for a significantly smaller proportion of the

leaks than human intervention.

Figure 7 presents leaks larger than 0.1kg/s on the NCS in 2008-11 divided into five

categories.

Figure 7 Categorisation of hydrocarbon leaks larger than 0.1kg/s on the NCS in 2008-11.

2 %

12 %2 %

64 %

20 %

External load

Design error

Process disruption

Human intervention

Technical degradation

29

About two-thirds of the leaks involve human intervention in connection with work on process equipment.

Technical degradation of the equipment accounts for 20 per cent of the leaks – a significantly smaller

proportion.

Examples of incidents in each category include:

human intervention (36 incidents): flanges tightened to the wrong torque, valves set in

the wrong position, reversing isolation while maintenance is under way, and incorrect

choice of gasket

technical degradation: (11 incidents): fatigue, corrosion and erosion

design errors (seven incidents): incorrect design of support solution and inadequate

vibration damping

process disruption (one incident): excessive pressure in the condensate tank, so that gas is

quickly diverted via a liquid seal

external load (one incident): a dropped load which hits process equipment or forklifts

which collide with such equipment.

Figure 8 presents the distribution of hydrocarbon leaks which have occurred in connection

with human intervention – in other words, the largest (dark blue) category in figure 7. This

shows that incorrect installation of flanges/bolts (wrong torque), valves set in the wrong

position after maintenance, incorrect blinding/isolation and incorrect operation of valves have

been important direct causes of hydrocarbon leaks. This means that observing routines/the

management system and ensuring that these accord with best practice become very important.

30

0

2

4

6

8

10

12

Incorrectblinding/isolation

Incorrect fittingof flanges orbolts during

maintenance

Valve(s) in wrongposition aftermaintenance

Incorrect gasketchoice or

installation

Incorrect valveoperation

Incorrect use oftemporaryhoses/lines

Break-down ofisolation system

duringmaintenance

Work onequipment

without knowingit was

pressurized

Figure 8 Categorisation of hydrocarbon leaks related to human intervention (i.e., the largest contributor in figure 7).

All flanges on hydrocarbon equipment, regardless of size, must be tightened with a

torque wrench, and the torque must accord with a predetermined bolt torque table. This

applies not only to flanges where the actual work on the hydrocarbon equipment is to be

done (when replacing a valve, for example), but also to those broken in connection with

isolation – such as blinds to be tightened by a process operator when reinstating a valve.

Tightening with an adjustable spanner could lead to a major accident.

Work on hydrocarbon equipment involves much more than just being able to assemble or

disassemble it. The job needs to be planned, barriers/isolations put in place, the actual work

carried out, and the barriers/isolations removed. See figure 1 on page 6. Errors can occur in all

these phases which lead to a hydrocarbon leak, either immediately or after start-up. Figure 9

presents the distribution of such errors in 2008-11. Note that more than one error has occurred

in most of the cases shown in the figure, given that verification is mandatory in all these

phases. Both execution and verification must fail for a hydrocarbon leak to occur.

31

Figure 9 Hydrocarbon leaks larger than 0.1kg/s in 2008-11 where the errors leading to the leak were related to

preparing the isolation plan, setting isolations/barriers, executing work on hydrocarbon equipment and reinstating

(n=32). The graph shows the date when the errors were made, not when the actual leak occurred.

A significant proportion of the errors which led to hydrocarbon leaks in 2008-11 occurred in planning the

job, setting barriers/isolations and during reinstatement – in other words, before and after the actual “job”

was executed.

How can you help to avoid this happening on your shift? What expectations do you have of your own

colleagues?

?

All the companies on the NCS require external verification of critical work processes. That includes

having another competent person checking that all barriers/isolations have been set in accordance with the

valve and blind list, and that reinstatement has been done properly. So why are errors not discovered

before they develop into a hydrocarbon leak?

There were 20 cases on the NCS in 2008-11 of the above-mentioned verifications failing and thereby

leading to a hydrocarbon leak larger than 0.1kg/s. In two-thirds of the cases, no verification at all was

done. As pointed out above, the consequences of hydrocarbon leaks can be huge. So performing all

verification activities as described in the company’s procedures is extremely important.

On steps 1-4 presented in Part 1

Reviewing governing documents to clarify how far their own practice accords with the best

practice specified in this document will be a matter for each individual company. It is

important that governing documentation is designed in a structured way, so that each

employee can acquire an overall picture of the procedures which apply in the specific case.

There must be an expectation of compliance with governing documents.

These recommendations are based on discussions with and comparison of routines in various

companies on the NCS. Each recommendation has already been implemented by at least

one company.

0 2 4 6 8 10 12 14

Reinstatement executed incorrectly, not discoveredduring verification

Work on hydrocarbon equipment executedincorrectly

Isolations/barriers set incorrectly, not discoveredduring verification

Isolation plan prepared incorrectly, not discoveredduring verification

32

The term “work on hydrocarbon equipment” is used in a wide sense in this report, and also embraces

the activities which must be implemented before and after the actual intervention in the hydrocarbon

equipment – including planning the job, isolation and reinstatement. All these activities are critical in

the sense that an error could lead to hydrocarbon leaks and present a major accident potential. It is

accordingly important that companies allocate sufficient resources (time and competent personnel) to

ensuring that all these critical jobs can be executed in accordance with the recommendations in this

document.

A review of investigation reports suggests that a number of hydrocarbon leaks in recent years have

related to a failure to verify that barriers are correctly set and removed. It might perhaps seem

unnecessary for two people to check that all valves/barriers are in the right position. But that is not the

case. Since the consequences of an error here can be just as serious as a plane crash, verification cannot

be dropped by anyone – even the most experienced.

On step 1 - plan

What this involves

The steps involved in the planning phase for work on hydrocarbon equipment are presented in

figure 10.

Evaluate isolation needs/

requirements

Prepare isolation plan

Verify and approve isolation plan

Isolations required

1 P

LA

N

Another competent person (area

technician/operations supervisor)

Area technician

Operations supervisor/Area technician in

cooperation with executing skilled worker

See WP process

Figure 10 Steps taken when planning isolations.

Example of execution A need for isolation is identified when planning a job. The area technician is normally the

person familiar with the process equipment, and he/she is consulted. He/she looks more

closely at the details of how the isolation is to be executed. This could involve electrical

isolation, mechanical isolation with blinding, isolation of safety equipment, assessment of

special methods required for the isolation and possibly the most suitable times for doing this.

That corresponds to the “evaluate isolation needs/requirements” step.

When that has been done, an isolation plan is prepared. This includes making a copy of the

master P&ID and using different coloured inks to enter on it the barriers included in the

33

isolation (marking) and the position they must be in (colour code). That provides the basis for

drawing up a valve and blind list. This corresponds to the “prepare isolation plan” step. When

complete, the isolation plan is passed to another competent person – normally another area

technician. The latter goes carefully through the plan to verify it, and signs it off. In addition,

the plan must be approved by the responsible operations supervisor. That corresponds to the

“verify and approve isolation plan” step.

It is important that the isolation plan/valve and blind list is prepared in such detail that it shows every

step to be taken when barriers are set and removed – all bleed points, for example, and all flanges to be

broken for leak testing. If this is not done, things could easily be overlooked during reinstatement even

if the valve and blind list is followed. Some companies have moreover opted to produce a step-by-step

description, which also includes the steps to be taken before and after the valve and blind list is to be

used. The key consideration here is that all the companies must think through the overall process and

ensure that this provides a robust result.

The level of detail in the valve and blind list is an important point to be checked by the responsible

operations supervisor who receives the isolation plan for approval. An example of points to be

checked is appended to this report.

Why it is important

Eleven hydrocarbon leaks where planning errors were a key contributory factor occurred in 2008-11. These include the following examples.

A process plant was restarted after an earlier gas leak (six days before) without adequate

leak testing. Those involved erroneously assumed they had found the fault which caused

the original release. A new gas leak thereby occurred.

The bolt torque list was not available. As a result, the torque specified for tightening

flange bolts was too low and led subsequently to a hydrocarbon leak.

Drawings from sub-contractors were inaccurate. A hydrocarbon leak occurred as a result.

An accurate P&ID is crucial. Should this contain errors, no steps later in the work process (figure 1)

will pick them up. As mentioned above, verification has been introduced for the isolation plan,

establishing barriers and reinstatement. However, none of these activities would be able to discover

errors in the master P&ID – they assume that the latter is correct. This means that routines for

amending the master P&ID, and for ensuring that work on an isolation plan is actually based on the

master P&ID, are critical for preventing major accidents.

Valves and the number of barriers

Substantial technological developments have occurred with valves in recent years. This means

that “established truths” about which valves can form barriers in an isolation are no longer

necessarily valid. Should doubts exist, a valve expert must be involved.

Various terms exist for valves to be used as double barriers. Designers distinguish between

“double block and bleed – DBB” and “double isolation and bleed – DIB”.13

The DIB

13

API 6D, ref /8/ is a common reference when ordering valves. A double-barrier valve is described in this

standard as a double isolation and bleed (DIB) unit. A double block and bleed (DBB) valve does not necessarily

have two barriers. These terms are used differently in the API and Norsok standards.

34

designation emphasises that this is a valve with two approved barriers. That means a DBB

valve does not necessarily have two approved barriers. To avoid misunderstandings, the

double barrier term is used in this document. The DBB and DIB designations are avoided.

The following applies with regard to the number of barriers.

The relevant Norsok committees should clarify the terms used for single and double

barriers. These designations are used differently by designers and operators.

The fact that a valve designated as DBB does not necessarily incorporate two barriers

should be included in the valve course.

If the seats have a common actuator/wheel for operation, locking the valve will be

particularly important. This is because a common wheel means that the barriers are not

independent (operating one barrier in error will automatically mean that the other

barrier is erroneously operated).

On step 2 - isolate

What this involves

The steps involved in the isolation phase are presented in figure 11 below.

Establish and leak test isolations +

purging

Verify isolations

Demonstrate zero energy – check

and prepare (interaction)

2 IS

OL

AT

E

Approve isolations

Area technician. A dedicated coordinator

where several disciplines are involved in

the isolation

Cooperation between several roles:

Area technician demonstrates to executing

skilled worker

Another competent person (normally

another area technician)

Operations Supervisor

Figure 11 The steps taken when setting the barriers (isolations).

Example of execution

The area technician takes the isolation plan with him into the process area to establish the

barriers specified in the valve and blind list. He follows the valve and blind list step by step,

ensuring that the isolations are placed in the position shown in this list and that the valves are

locked14

in the correct position as specified by the individual company’s procedures. The

setting of each isolation is ticked off on the list. If flanges are broken or plugs removed as part

14

A number of companies require that the barriers should be locked in the correct position with a key. See

below.

35

of the isolation, the list of break sections is updated. A leak test is then conducted with the

barriers and the segments which are later to be opened gas-free. The area technician signs that

this has been done.

Another area technician must then go through the same steps in the valve and blind list and

verify that all the barriers are in the correct position. He must also follow the valve and blind

list careful step by step,15

and then sign that this has been done.

Once the verification has been completed, the responsible operations supervisor is contacted.

He asks a number of questions to check that isolation and verification have been conducted in

accordance with best practice. That includes assuring that normally depressurised systems

(such as the equalisation manifold) have been pressurised during leak testing, and that the

energy source which powers actuator-controlled valves is adequately safeguarded. The latter

can be ensured, for example, by disconnecting the hydraulic line to prevent an internal

hydraulic leak inadvertently operating the valve. This conversation concludes with an

approval of the isolation, and the responsible operations supervisor signs.

A number of other functions, such as the platform manager and the HSE department, will

normally be involved in connection with the work permit for the pressurised equipment. This

depends on the work permit system in each company. A work permit is mandatory for starting

work on the hydrocarbon equipment.

Immediately before work on the hydrocarbon equipment begins, an interaction meeting is

held where the area technician demonstrates to the executing skilled worker that the

equipment has been depressurised. Exactly how this is done depends on the hydrocarbon

system. The demonstration could involve, for example, opening a valve (to show that no gas

is escaping) or trying to start a pump which forms part of the isolation (to show that it actually

fails to start). Zero energy is documented16

in accordance with the procedures. The executing

skilled worker must not start the job until the interaction meeting has taken place.

15

Making provision for conducting the verification independently of the first check is crucial. How this can be

achieved is discussed below. 16

Some companies have introduced a system with a “green tag” hung up at the work site. Nobody can start a job

until this tag is in place, which ensures that the interaction meeting actually takes place.

36

Figure 12 Example of a locking pin which physically locks a valve spindle. This prevents erroneous operation of the

actuator changing the valve’s position.

Independent verification of isolations is extremely important. The companies must accordingly ensure

that this can always be done. If not, the job cannot be executed. No manager/supervisor must accept

“silent nonconformity” when required verification is not done.

Independent verification can be accomplished in several ways. Some companies, for example, have

opted to require that the executing person and the verifier operate separately, while others have good

experience of allowing the two functions to act at the same time.

The key requirement is that all companies must establish a procedure which ensures the greatest

possible independence between the executor and verifier. It is up to the individual company to describe

how this can be achieved in its own governing documentation.

Why it is important

Thirteen hydrocarbon leaks where errors during isolation were a key contributory

factor occurred in 2008-11. Causal analyses show that, of all the steps in the work process,

this is the one where mistakes have led to the largest number of hydrocarbon leaks. Such

incidents include the following examples.

Isolation was implemented by the night shift, but a mistake was made. Verification that

the barriers had been correctly set was left to the day shift, but was not carried out. The

job was then executed without it being discovered that no verification had been done, and

this led to a hydrocarbon leak.

No isolation plan was normal practice on the relevant shift. This made it impossible to

verify whether the isolations/barriers had been correctly set. Moreover, the platform

management had not discovered that this practice conflicted with governing

documentation in the company. The result was a hydrocarbon leak.

A maintenance team was flown across to a normally unmanned facility to carry out work

on hydrocarbon equipment. However, the team lacked a dedicated competent person to

verify that the barriers/isolations were correctly implemented and removed. This meant

that the crew sent across to the facility were not capable of doing the job in accordance

with the work instruction. The result was a hydrocarbon leak.

37

?

Figure 11 presents the steps for best practice in executing isolations. What is required for an error in the

isolation phase to develop into a hydrocarbon leak?

First, the area technician must make a mistake when the barriers are set in accordance with the valve

and blind list (see the step on “establish and leak test isolations + purging”). Then the person who

verifies the isolations must overlook the error made (see the step on “verify isolations”). If someone

(erroneously) has failed to use the valve and blind list or the verification has (erroneously) been

dropped, this should normally be picked up in the “approve isolations” step. A failure to spot this

would also be an error by the responsible operations supervisor.

Which of these two variants do you think have occurred most frequently in connection with

hydrocarbon leaks in recent years?

1) Verification has been performed without spotting an error

2) Verification has not been performed at all

An overview of hydrocarbon leaks larger than 0.1kg/s in 2008-11 shows that verification was not

performed at all in two-thirds of the cases where an error occurred in this step. In other words, variant 2

looks like presenting the biggest challenge.

NB! This does not necessarily mean that dropping the verification step is a widespread occurrence. It

means that if you drop this step, a significant chance exists that a hydrocarbon leak will result. This is

because you knowingly eliminate one of the barriers.

Locking valves which should not be operated because they are part of the isolation

Varying practice has been identified with regard to locking valves included in the isolation.

Variant 1. A requirement that valves must be padlocked. Five keys are placed in a lock-

out box: one for the control room, two-four for the executing skilled workers. The

executing person must sign the isolation certificate to state that the job has been

completed, and this is checked before the key is handed over. Personal isolation: this

represents an exception in the system described above, used for small simple jobs which

are not critical and where the operator is present throughout.

Variant 2. Almost the same as the above, but one of the keys is placed with the

mechanical department. Has lock sets with many matching keys – 50, for example, if

there are 50 isolations.

Variant 3. Chain, wire lock or the like. Seals are removed by the operators when such

removal has been approved.

Variant 4. Use of strips as a minimum. Recommends increased use of padlocks and

interlock systems. Temporary locks can be used if the valve lacks attachment points.

Locking is not required in the work process.

Variant 5. Valves not locked (but labelled). Also has an activated interlock system.

It must be possible to verify the position of the valve without having to remove the lock.

38

Figure 13 Example of a locking system (right) and lock-out box (left)

Read the description of the course of events in the Piper Alpha accident in table 3 on page 25. Could

this accident have been avoided if the start button for the pump had been locked in accordance with

normal practice for electrical isolation? In that case, those who had removed the safety valve (PSV no

504) would have had the only key to the key box. It would then have been necessary to contact them

before the pump could be started. The night shift might then have discovered that work on the PSV had

already begun and that the pump must not be started. It is difficult to draw a final conclusion on this.

However, the example clearly indicates the advantage of a lock system – namely, that everyone

involved must be “in agreement” to undo the lock. This reduces the chance of misunderstanding.

On performing verification

Discussions have taken place in the work group over requiring verification to be performed

after the job has been done, or whether it is just as safe to allow the two functions to be

pursued simultaneously. An example: a company has had a hydrocarbon leak where

verification involved the executing worker and the verifier proceeding in parallel, and

believes that this could have contributed to a failure to spot an error. On the basis of that

incident, the company has opted to amend its routines so that they now specify that the

executing worker and the verifier must not proceed together. However, another company has

had good experiencing of allowing this since it facilitates positive technical dialogue along the

way which can clarify misunderstanding and the like. If the executing worker and the verifier

go round together, it is important that they are conscious of exercising their roles as

independently as possible. An opportunity has been identified here for further research/studies

on what represents the best practice for verification. On the basis of the considerations

outlined above, both variants are allowed. It will be up to each company to define internal

requirements for the way verification is to be performed.

39

On step 3 – Execute (work on hydrocarbon equipment)

What this involves

The part of the flow diagram which relates to work on hydrocarbon equipment is presented in

figure 14 below. No details have been provided about the contents of this step, since these can

differ widely depending on the equipment concerned. The common denominator is breaking

into hydrocarbon equipment – flanges are broken.

Work on HC equipment

3 E

XE

CU

TE

See WP process

Figure 14 Work on hydrocarbon equipment.

Example of execution

Isolation, preparation and so forth are now complete, and everything is ready for doing the

actual job on the hydrocarbon equipment. This involves replacing a valve, and an SJA will

then be required in certain cases. Possible work accidents are discussed at the meeting, such

as dropping the valve and thereby causing a personal injury. In addition, however, possible

incidents which might lead to a major accident are covered. Examples of critical points

include the following.

Visual check of the valve – particularly plugs, since experience has shown that these may

be the wrong type in new valves.

Cleaning flange surfaces is critical, since errors here could lead to leaks. It is also

important to be absolutely certain about installing the correct gasket.

Choice of bolt torque table – is it possible to be absolutely certain that the right one is

being used?

Use new bolts, since corrosion protection/friction on the bolt surface is incorporated in

the calculations which form the basis for the bolt torque table. If bolts are re-used,

corrosion protection could be worn and friction inaccurate, which could lead to the

wrong torque being applied.

Ensure that the correct tool is used to tighten the bolts to the right torque.

Measure: two people must check that the correct gasket has been chosen, that everything

is OK before the components are assembled, that the tightening tool is correctly set and

so forth.

The job is then done as planned. All the steps included in the work permit system are

executed, including signing that the work has been done and the work site cleared up

Note how little of the flow diagram in figure 1 is occupied by the actual job. Most of its steps involve

preparing for the work and reinstatement afterwards. So much emphasis has to be given to planning and

reinstatement because of the major accident potential. In addition, experience shows that many of the

errors which lead to gas leaks occur precisely in these steps. See figure 9 on page 31.

40

Why it is important

Twelve hydrocarbon leaks where errors during the actual job were a key contributory

factor occurred in 2008-11. Such incidents include the following examples.

The bolts on the flange were tightened asymmetrically. This resulted in a hydrocarbon

leak.

A check valve was installed the wrong way round. This resulted in a hydrocarbon leak.

Plugs removed while the work was under way were not reinstated. This resulted in a

hydrocarbon leak.

On step 4 – reinstate

What this involves

The steps involved in removing isolations are presented in figure 13.

Inerting and leak test

Verify removal of isolations and

reinstatement of break points

4 R

EIN

ST

AT

E

Approve reinstatement

Re

insta

tem

en

t an

d

ve

rifica

tion

in p

ara

llel

Remove isolations

Isolations removed

Area Technician

Area technician

Another competent person (normally

another area technician)

Executing skilled worker

Area/operations supervisor

Figure 15 Steps involved in removing isolations.

Example of execution

The job has been done and reinstatement can begin. A responsible person approves the start of

reinstatement (interaction where the executing skilled worker also participates). The purpose

of this step is to ensure that nobody starts reinstatement too early because they (erroneously)

“think” the job has been finished. See the Piper Alpha accident outlined on page 25. The

actual reinstatement is normally carried out by an area technician. Systematic use of the

isolation plan/valve and blind list and the list of break sections is important for this work in

order to ensure that everything has been correctly reinstated. For that reason, another

competent skilled worker (normally another area technician) performs an independent

verification that all the barriers/isolations have been correctly removed and that all flanges

and plugs are installed. This person also uses the valve and blind list and the list of break

sections, and signs on these. Leak testing of all flanges which have been broken for the

isolation is important. That applies not only to flanges at the actual work site, but also to those

41

broken in connection with the isolation. To achieve this in practice, it may be necessary in

some cases to perform inerting, leak tests, removal, and verification of correct removal in

parallel. When these activities have been completed, the job is finished in accordance with the

work permit system and the process plant can be restarted.

Why it is important

Six hydrocarbon leaks where errors during isolation were a key contributory factor

occurred in 2008-11. Such incidents include the following examples.

The removal of plugs was not detected either by the executing worker or the verifier.

This resulted in a hydrocarbon leak.

Verification of the reinstatement was dropped. During the work, the facility was

demobilised and then remobilised with different personnel. That may have contributed to

the failure to verify. This resulted in a hydrocarbon leak.

Having routines in place which ensure that all relevant equipment has actually been reinstated is

important. That applies, for example, to ensuring that transmitters are not left disconnected for long

periods because of a failure to reinstate them.

On test methods

A number of test methods are available for different purposes. Examples include gross,

sensitive (N2/He) and in-service leak tests, a vacuum test and a pressure test. The first three of

these are used in the operations phase after work on hydrocarbon equipment – to check, for

example, that flanges which have been broken are tight before hydrocarbons are reintroduced.

A pressure test is used for certification of new or modified equipment – such as checking that

a weld can withstand the pressure specified for the pipe. In these cases, the equipment to be

tested is physically disconnected from the rest of the plant. The test will often be conducted

on shore or in an offshore workshop. A vacuum test is used to demonstrate that liquids are not

intruding from external sources in equipment designed to operate in a vacuum.

After discussing test methods in the work group, it is clear that practice for conducting them

varies even though their “designation” may be the same. These differences involve both the

sequence in which valves are tested and the actual test procedure.17

Practice appears to differ

both between and within companies. As a result, companies need to specify how each test

should be performed in practice and not simply require that a certain type of test be carried

out. The issue can perhaps be discussed in even more detail at industry level.

Criteria for passing a test

Regardless of which of the above-mentioned tests are used, the leak rate discovered will be

significantly lower than the one which concerns the project (larger than 0.1kg/s). This report

17

Some examples. Should soapy water or spray be used to identify leaks? How should taping be done, and when

should tape be used? Packing the “whole” flange with subsequent detection of the O2 content in the “bag”?

42

accordingly does not discuss the criteria for passing a test, but refers to the

operator/contractor’s own procedures.

Important considerations when performing a test

Ensuring that all the flanges which have been broken are tested is important. Indicate

broken flanges on the P&ID. A plan for performing the tests must be available on large

jobs – divides into packages, for example.

An assessment must be made of whether taping/sniffing (O2) or soap spray is the most

practical solution.

Leaks can also occur around bolts on compact flanges, and not just from the gasket

surface. One method of discovering leaks here is accordingly to pack up the whole

flange, including bolts.

Ensuring that the injection point for testing has been correctly placed in relation to the

direction of flow for a backflow valve is important.

In order to test the whole valve, certain types (such as ball valves) must be placed in their

intermediate position during the test.

Before testing. Checking that the system is designed for the test pressure is important.

Installing overpressure protection must be considered in cases where the supply pressure

exceeds the operational pressure of the equipment being tested.

Checking transmitters (by monitoring pressure in the control room) is appropriate in

parallel with leak testing.

A plan must be established in advance for where/how the test medium is to be bled off

once the test is completed or in the possible event of a leak.

The bleed point between double barriers can be tested after the leak test has been

completed and hoses disconnected, in connection with the removal of barriers/isolations.

Testing barriers included in the isolation

Consider establishing a blocking pressure with nitrogen on certain valve types to ensure

pressure on the barriers.

It is recommended that all valves used as an isolation must be testable. That also applies

to valves against the flare system. Proposals are made on this to design teams. An issue

on certain facilities is that the system has been rated for flare pressure, and the equipment

will thereby be tested above design pressure if the test is conducted in the usual way. A

provision that isolation valves must be testable should be incorporated in the relevant

Norsok standards.

On secure areas

Varying practice has been identified for labelling equipment included in the isolation.

Examples include the following.

Red label = closed valve. Green label = open valve.

Red label = not normal position. Green label = identified correct equipment and

confirmed depressurised.

Red label = part of the operational isolation.

White label = open or closed valve as specified in writing. Red label = blind.

White = identification of bleed/vent.

43

References

/1/ PSA. RNNP – trends in risk level in the petroleum activity, 2011. Published 25 April 2012.

/2/ Norwegian Oil and Gas 088: Recommended guidelines for common model for work permits. Last revised December 2011.

/3/ Norwegian Oil and Gas hydrocarbon leak reduction project. Analysis of causes of hydrocarbon leaks in 2008 -2011. Rev 1, 8 June 2012. Preventor report number 2011103-01.

/4/ http://www.ptil.no/storulykke/risiko-for-storulykke-article3704-13.html

/5/ www.wikipedia.org

/6/ BBC. Spiral to disaster. DVD which provides an informative description of events in the Piper Alpha accident. http://www.bbcactivevideoforlearning.com/1/TitleDetails.aspx?TitleID=617

/7/ Leistad, G H and Bradley, A R. Is the focus too low on issues that have a potential to lead to a major incident? SPE paper no 123861 (2009).

/8/ API 6D Specification for pipeline valves, 23rd edition (Identical to ISO 14313:2007).

/9/ PSA. Management regulations. http://www.ptil.no/management/category401.html

/10/ HSE: Health and Safety Executive. The safe isolation of plant and equipment. http://www.hseni.gov.uk/hsg253_the_safe_isolation_of_plant_and_equipment.pdf

/11/ Example of a wireless transmitter: http://www.automation.siemens.com/w1/index.aspx?nr=18793.

/12/ Norsok L004: http://www.standard.no/pagefiles/18186/l004u2.pdf

/13/ Norwegian Oil and Gas: Håndbok i flensarbeid. http://www.norskoljeoggass.no

/14/ ASME PCC-1. Guidelines for Pressure Boundary Bolted Flange Joint Assembly. March 5 2010.

/15/ Røed, W, Vinnem, J E, and Nistov, A. Causes and Contributing Factors to Hydrocarbon Leaks on Norwegian Offshore Installations. International Conference on Health, Safety and Environment in Oil and Gas Exploration and Production, 11-13 September 2012, Perth, Australia. http://www.onepetro.org/mslib/servlet/onepetropreview?id=SPE-156846-MS&soc=SPE

44

Appendix

Example of checkpoints related to the “approve isolations” step. (In other words, points

which the responsible operations supervisor must check as having been done through

conversation with those executing the isolation.)

P&ID checked against the master archive.

Master isolation plan signed.

System depressurised and drained.

Depressurised trapped volume in the valve housing.

Checked with the person who has installed blinds that these are certified and accord with

the piping specification.

Necessary heating cables have been laid out/disconnected.

Equipment has been laid out and locked electrically (pumps, motors, etc.)

Radiation sources have been placed in a safe position/measured by the radiation

supervisor.

Manual valves are secured in the correct position.

Actuator-controlled valves are secured in the correct position.

The power supply to actuator-controlled valves is physically secured.

The system has been inerted and the nitrogen hoses disconnected.

Isolation valves against pressure sources are leak tested.

The hydrocarbon content must be less than three per cent by volume before breaking into

the system.

Tanks and vessels are flushed with air before being entered. The O2 content must be 20.9

per cent. Checks have also been made for substances hazardous to health and

hydrocarbons.

Possible internal company rules/procedures, such as the A standard or golden rules

(content varies from company to company).

Principles to be taken into account when preparing valve and blind lists

Numbering which refers to the P&ID.

Number on the P&ID.

Clear identification of equipment, such as tag number, line number and text description.

For valves: status open or closed.

Signature field “isolation performed” for each unit (valve or blind).

Signature field “isolation verified” for each unit (valve or blind).

Signature field “isolation removed” for each unit (some companies have separate lists for

reinstatement).

Signature field “isolation verified removed” for each unit (some companies have separate

lists for reinstatement).

A system must be in place to pick up changes. NB! This does not mean changes in the

location of the barrier, but in its position/status.

Principles for the list of break sections

All break points must be included in the list, including plugs. This will typically be a

“blank” list, with each break point entered as breaking proceeds.

Signature field that each break has been reinstated.

Signature field for verification of the reinstatement of each break point.

45

Examples of columns which can be included in a list of break sections

Description. This field is used to describe the type of pipe the flanges are on – water out

of HP separator, to closed drain, to flare and so forth

Line number. Must be completed if any doubt exists about the pipe concerned – if the

equipment has two lines to a closed drain, for example.

Module. The module in which the flange is broken.

Where. This must contain an accurate description of the flange concerned, specifying its

location on the line and/or where it is located in the module. Examples: between XV-

05412 and PT-03652 under the HP separator, south of the metering package, second

flange downstream from PT-xxxx and so forth. Should a valve be dropped out, its tag

number must be included.

Number of flanges. Enter the number of flanges which have been broken at the specified

point. If a valve has been dropped out, for example, the number 2 must be entered.

Date of the break and signature. This is included in order to know when the break was

made and to have somebody for possible questions.

Torque label. Sign after going into the field and finding the torque label. This verifies

reinstatement of the break point.